Configure SIEM Security Operations Using Microsoft Sentinel - Applied Skills Workshop

• Fundamental understanding of Microsoft security, compliance, and identity products
• Intermediate understanding of Microsoft Windows
• Familiarity with Azure services, specifically Azure Virtual Machines
• Familiarity with Azure virtual machines and virtual networking
• Basic understanding of scripting concepts

Module 1: Create and manage Microsoft Sentinel workspaces

Learn about the architecture of Microsoft Sentinel workspaces to ensure you configure your system to meet your organization's security operations requirements.

• Introduction
• Plan for the Microsoft Sentinel workspace
• Create a Microsoft Sentinel workspace
• Manage workspaces across tenants using Azure Lighthouse
• Understand Microsoft Sentinel permissions and roles
• Manage Microsoft Sentinel settings
• Configure logs
• Knowledge check
• Summary and resources

Module 2: Connect Microsoft services to Microsoft Sentinel

Learn how to connect Microsoft 365 and Azure service logs to Microsoft Sentinel.

• Introduction
• Plan for Microsoft services connectors
• Connect the Microsoft Office 365 connector
• Connect the Microsoft Entra connector
• Connect the Microsoft Entra ID Protection connector
• Connect the Azure Activity connector
• Knowledge check
• Summary and resources

Module 3: Connect Windows hosts to Microsoft Sentinel

One of the most common logs to collect is Windows security events. Learn how Microsoft Sentinel makes this easy with the Security Events connector.

• Introduction
• Plan for Windows hosts security events connector
• Connect using the Windows Security Events via AMA Connector
• Connect using the Security Events via Legacy Agent Connector
• Collect Sysmon event logs
• Knowledge check
• Summary and resources

Module 4: Threat detection with Microsoft Sentinel analytics

In this module, you learned how Microsoft Sentinel Analytics can help the SecOps team identify and stop cyber attacks.

• Introduction
• Exercise - Detect threats with Microsoft Sentinel analytics
• What is Microsoft Sentinel Analytics?
• Types of analytics rules
• Create an analytics rule from templates
• Create an analytics rule from wizard
• Manage analytics rules
• Exercise - Detect threats with Microsoft Sentinel analytics
• Summary

Module 5: Automation in Microsoft Sentinel

By the end of this module, you'll be able to use automation rules in Microsoft Sentinel to automated incident management.

• Introduction
• Understand automation options
• Create automation rules
• Knowledge check
• Summary and resources

Module 6: Configure SIEM security operations using Microsoft Sentinel

In this module, you learned how to configure SIEM security operations using Microsoft Sentinel.

• Introduction
• Exercise - Configure SIEM operations using Microsoft Sentinel
• Exercise - Install Microsoft Sentinel Content Hub solutions and data connectors
• Exercise - Configure a data connector Data Collection Rule
• Exercise - Perform a simulated attack to validate the Analytic and Automation rules
• Summary